dsh-providers-extension

DSH Providers Extension

Manage LLM providers, accounts, model catalogs, reasoning effort, and provider execution modes from one DeepSeek Harness interface.

简体中文 · Full guide · 中文使用指南 · Changelog · Security · Contributing · License

Install

0.1.0 supports DeepSeek Harness 0.1.0-rc.7, pi-ai >=0.82.1 <0.83.0, and Node.js ^22.19.0 || >=24.0.0. DSH delegates plugin operations to pnpm, so pnpm must be on PATH.

dsh plugin --profile web add @fhxgs/dsh-providers-extension@0.1.0

Check the composed profile before starting the UI:

dsh --profile web --dump-config
dsh web

The dump must contain the @fhxgs/dsh-providers-extension bundle and the fhgs-providers-extension row. After DSH starts, open Settings → Models.

What it adds

• One Models area: built-in DSH Providers, OAuth accounts, API routes, and custom OpenAI-compatible endpoints share one control plane without losing their separate identities.
• Live catalogs: refresh model lists without signing in again. A failed refresh keeps the last known good catalog and credential.
• Exact selections: every choice retains Provider, route/account, model, reasoning effort, and Provider-owned mode such as fast, priority, or flex.
• Separate defaults and sessions: a new-session default does not rewrite an existing session. Composer and /model changes affect only the current session.
• Visibility controls: choose which models, effort values, and modes appear in pickers without silently terminating a running session.
• Replay-safe routing: request history keeps the route and binding identity required to replay against the same account.
• Fail-closed activation: an unknown, incompatible, or drifted Host stays on native DSH.

The complete feature, installation, configuration, compatibility, architecture, security, and release reference is in the full guide.

Provider paths in 0.1.0

Provider path	Status	Use it through
DSH built-in Providers	Available	Host API key, environment, Bedrock, Vertex AI, or another native identity chain
Custom OpenAI-compatible endpoint	Available	Settings → Models → API → Add custom provider
Google Gemini OAuth	Deployment client required	A deployment-owned Google Desktop OAuth client and quota project
OpenRouter	API key only	Host/API route; public OAuth is blocked in this release
Hugging Face	Fine-grained token only	Host/API route; public OAuth is blocked in this release
OpenAI	API/workload identity or explicit Host Agent Bridge	Consumer ChatGPT/Codex login is not imported
Anthropic	API or Host-native enterprise identity	Claude subscription and Claude Code credentials are not imported

An implemented protocol is not automatically an approved public identity path. The extension exposes a login action only after the driver and compliance record both allow it.

Selection model

A durable selection keeps five axes separate:

Provider → Route/account → Model → Effort → Mode

Provider default means that no explicit mode is sent. It is not an explicit mode named default. A high-speed model SKU remains a Model; a Provider service tier is a Mode only when its driver declares the exact wire binding.

Safety boundary

Credentials stay in the Host credential backend. They do not enter settings documents, Browser snapshots, catalog caches, session logs, screenshots, source maps, or npm artifacts. PKCE verifiers and authorization codes remain in Host memory.

Before attaching a saved credential, custom endpoints are checked for HTTPS, public DNS and connected addresses, same-origin redirects and catalogs, supported secret headers, bounded responses, and the absence of query-string secrets. Private, loopback, link-local, metadata, DNS-rebinding, cross-origin, and oversized-response targets are rejected.

Do not edit the compatibility manifest to force activation on another DSH build. Each Host version needs its own reviewed profile.

Local checkout: one command

From a standalone clone with dependencies installed:

npm run dsh:install:local

For a fresh clone:

git clone https://github.com/yhyfhgs/dsh-providers-extension.git
cd dsh-providers-extension
npm ci --ignore-scripts && npm run dsh:install:local

From the private Collab workspace root, point the installer at that workspace's DSH CLI:

DSH_BIN="$PWD/deepseek-harness/apps/cli/lib/bin.js" npm --prefix providers-extension run dsh:install:local

Use -- --profile <name> to link a disposable profile instead of web.

Documentation

File	Contents
README.md / README.zh.md	Public overview and quickest install path
docs/GUIDE.md / docs/GUIDE.zh.md	Features, installation, configuration, compatibility, architecture, performance, security, and release verification
CHANGELOG.md	Versioned changes
.github/SECURITY.md	Private vulnerability reporting and supported versions

Develop

npm ci --ignore-scripts
npm run check

The repository also contains a credential-free UI prototype:

npm --workspace @fhxgs/providers-extension-prototype run dev -- --host 127.0.0.1 --port 4173

The prototype uses mock data. It demonstrates the interaction contract but does not prove Provider eligibility, real-account OAuth behavior, or compatibility with another Host build.

0.1.0 limits

This release does not provide automatic cross-Provider fallback, multi-account rotation, remote policy downloads, a public third-party driver SDK, implicit vision routing, consumer-subscription credential reuse, public OpenRouter or Hugging Face OAuth, or compatibility with unreviewed DSH builds.

License

MIT © 2026 fhgs.